Showing papers in "ACM Sigsac Review in 1991"
[...]
TL;DR: In any enterprise, there are many aspects to security, and they apply to different divisions of the enterprise: manufacturing, shipping, sales, administration, etc, including that of the computer department.
Abstract: In any enterprise, there are many aspects to security, and they apply to different divisions of the enterprise: manufacturing, shipping, sales, administration, etc. Those of us who work with computers know that we have to think about security just as much as those working in other divisions have to. In each different area, there are threats or dangers which must be protected against. Some of these threats may be specific to a particular department while others are common to several different departments. For each particular threat there may several different measures that can be taken to protect against it. We can divide all measures into three categories: physical, operational and administrative. When we examine each of these categories, we find that they all apply to the security of every division and department of an enterprise, including that of the computer department.
178 citations
TL;DR: An alternative solution to the dilemma found in a neural network is proposed, an artificial intelligence connectionist model which is fault tolerant, self adaptative to learn automatically, retaining experience to solve the problem of virus identification regarding fuzzy information on concerns and effects.
Abstract: Computer viruses are more and more numerous: around 400 in the year 1990 and this number is estimated to reach 1,000 for 1994-95. Users are not experts and need help in identifying the virus and carrying out the most appropriate cure in case of attack.Knowledge of viruses is necessary but public information offered by virus database or catalogs gives a powerful advantage to virus makers. On the other hand, not enough or no information to users is also a problem because then they use the product they have which does not necessarily provide the appropriate solution in case of virus attack. We propose an alternative solution to the dilemma found in a neural network, an artificial intelligence connectionist model which is fault tolerant, self adaptative to learn automatically, retaining experience to solve the problem of virus identification regarding fuzzy information on concerns and effects.Principles of the formal neuron and the neural network using hidden nodes is examined as well as the theoretical and practical apects of the gradient back propagation algorithm. An implementation of the algorithm is applied to virus identification with data referring to virus concerns and their obvious effects. First results have shown a correct identification of viruses while using fuzzy knowledge of end users introducing uncertaincy on answers or, even, forcing erroneous data. Such a system can be employed by ordinary users, system or computer security managers, as well as consultants as a complementary tool for virus warfare.Further work needs to be conducted to validate methodologically such an approach and to optimize input data coding, the choice for parameters and the learning strategy.
8 citations
TL;DR: It is suggested to apply a flexible management prevention program adapted to environment, men and virus changes in relation with a normal use of information systems which have to play their economic and strategic roles without losses.
Abstract: Viruses propagate easily with economic consequences that are difficult to estimate. Appropriate means of prevention, detection and protection are needed to preserve integrity and availability of computer systems. Prophylaxis effects first have to be reasearched to provide data for choice of appropriate measures according to the general security policy. Several models for virus propagations borrowed from biology have been developed in the continuous case to indicate that segregation controls imposed by file value increase the population density of virus. This confirm previous experimental results obtained by F. Cohen on personal computers and mainframes.Uniform virus prevention is highly recommended rather than segregation by file value which is basically the principle of most of centralized packages. Also, security measures offered by most of the resource access security systems are not effective for virus infections which can pass high security levels when they are introduced by trusted users. It is suggested to apply a flexible management prevention program adapted to environment, men and virus changes in relation with a normal use of information systems which have to play their economic and strategic roles without losses.Two perspectives are suggested. The first makes reference to the SRI's real-time Inrusion-Detection Expert System (IDES) based on statistical tests for abnormality, considering deviations from an expected behavior. It works for individual as well as group users or remote hosts. The second proposes the use of neural networks as another technical solution actually available. It should work for such an anomaly detection based on behavior segregation rather than value.
5 citations
TL;DR: Until a new encryption standard emerges, the exposure and consequences can be avoided by the adoption of double-length keys for DES, which is technically and economically feasible.
Abstract: DES is used almost universally by financial institutions (Fls) around the world. For the foreseeable future there are no alternatives to its continued use. Within ten years unmodified single-key DES will be breakable for a cost of about $3,500 per solution in under one day. Many financial systems which currently rely on single-key DES are therefore becoming vulnerable to attack.Despite the impact of breaking DES, the misconception that an FI's exposure is limited to the dollar values of particular short-lived transactions may make users unwilling to undertake urgent remedial measures. They may be prepared to tolerate risks they perceive as limited and unrealistic. This view ignores the danger that a breach of key management security poses to the system as a whole.Until a new encryption standard emerges, the exposure and consequences can be avoided by the adoption of double-length keys for DES. This is technically and economically feasible. Double-length keys and unique keys per transaction should be implemented in financial systems as soon as possible.
4 citations
TL;DR: As more and more business information is transmitted between computer systems, there is an increased need to protect these Electronic Data Interchange (EDI) encoded transactions from unauthorized viewing and/or alteration.
Abstract: As more and more business information is transmitted between computer systems we are seeing an increased need to protect these Electronic Data Interchange (EDI) encoded transactions from unauthorized viewing and/or alteration. EDI transactions carry market intelligence such as item name, quantity, purchase price, delivery dates, etc. Unauthorized viewing can provide competitive information we may not want disclosed. With the advent of the Payment Order/Remittance Advice transactions, sensitive payment information such as payment amount, bank identification and bank account numbers can be carried in an EDI transaction. Alteration of any of these fields can result in an improper payment being made.
2 citations
TL;DR: This work advocates the addition of protection domains to the current NASA schema, which establishes four hierarchical levels of automated information sensitivity and criticality and provides guidance for appropriate protective measures for each level.
Abstract: In applied efforts to reduce the cost of the software life-cycle process, government agencies and industry are focusing on the reusability of software. Software reusability, both between various automated information systems and software projects, has become a primary requirement in many requests for proposals. Software reusability is, perhaps, one of the most significant low technology, cost-cutting methods available to the data processing community today. Without effective protective measures established and in place, however, reusing software can result in the proliferation of malicious code, resulting in the loss of dollars, possibly even lives. An effective protection plan for reusable software must combine verification of the software by the developer, appropriate protection of the software during both storage and use, guaranteed delivery and integrity when software is transferred, and re-verification of software by the new user prior to incorporation in a new design. NASA's approach to software protection establishes four hierarchical levels of automated information sensitivity and criticality and provides guidance for appropriate protective measures for each level. We advocate the addition of protection domains to the current NASA schema.
1 citations
TL;DR: The authors in the information security community have lost their claim to innocence and need to heed Santayana's advice and not ignore history in examining early on the threats software warfare may pose now and in the distant future.
Abstract: We in the information security community have lost our claim to innocence. We have known sin. For years, we have been viewing ourselves as crusading defenders of the faith, guardians of a mythical "cyberspace" community against the infidels of computing, those who would penetrate, vandalize, and exploit the systems of innocent users. We have painted the security technology we have been developing as good and the intrusive methods developed by the "hackers", "phreaks", and computer terrorists as bad. The labels appeared clear - we, the computer security folks, wore the white hats and the other guys, the black. However, in much the same way that knowledge of computer security flaws aided the penetrators of systems, so our knowledge of malicious software methods has contributed to our ability to build more robust, resilient, intrusion-resistant systems. Where we differ from the bad guys, we think, is in application and motive for use. But times are changing. The spectre of computer warfare, the dark twin to INFOSEC, has arisen. The computer security technology that we selectively considered as benignly good has a darker side which is becoming more apparent, as happened to the technologies for nuclear energy and biochemistry. If history has been any teacher, computer technology, security related or otherwise, will be no exception. We now have a two-edged Sword of Damocles at our disposal. It, like its nuclear and biochemical warfare cousins, is poised to hang over our heads. We need to heed Santayana's advice: "Those who cannot remember the past are condemned to repeat it." and not ignore history in examining early on the threats software warfare may pose now and in the distant future.
1 citations
TL;DR: Asymmetric cryptosystems are based on hard number-theoretic problems such as integer factorization or taking discrete logarithms in finite groups and their performance aspect are well investigated.
Abstract: Most asymmetric cryptosystems are based on hard number-theoretic problems such as integer factorization or taking discrete logarithms in finite groups [2]. Their performance aspect are well investigated [3].
1 citations
TL;DR: This checklist was originally developed for microcomputer LAN managers and computer security specialists and was later expanded to cover main frames and minicomputers as a result of requests from the different organizations with whom the authors have worked.
Abstract: This checklist was originally developed for microcomputer LAN managers and computer security specialists. It was later expanded to cover main frames and minicomputers as a result of requests from the different organizations with whom we have worked.
1 citations
TL;DR: A possible software solution for 1024, 1279, 2048 and 4096-bit numbers which combine software and general purpose hardware which makes use of the Discrete fast Fourier Transform (DFT) and produces first results which can be compared to others like Karatsuba's or modular arithmetic.
Abstract: Year after year, there is an incredible increase in computation power delivered by parallelism and new kinds of processors. The length of integers involved in the computations in public-key cryptosystems will probably be more than one thousand bits within the next ten years to warranty a good security level.The proposal is to present a possible software solution for 1024, 1279, 2048 and 4096-bit numbers which combine software and general purpose hardware. The algorithm implemented makes use of the Discrete fast Fourier Transform (DFT) and produces first results which can be compared to others like Karatsuba's or modular arithmetic.Considering these results for cryptographic applications using asymmetric systems for key exchanges one can take advantage of such a method for modular exponentiation but only for operations involving more than 1024 bits. While using a quad-transputer board equipped with the new T9000 family transputers, software modular exponentiation involving 1024-bit numbers should take under 0.5 s, 2048 bits under 2 s and 4096 bits less than 8 s which takes more time but insures the future of the just necessary security ! Expected results for this method show possible software applications for highly secure key exchange protocols using general purpose new chips (INMOST9000 transputer or Intel 1860 when used in piped mode).
TL;DR: It was in the Washington Post that it was confirmed that after 72 unsuccessful attempts to pass the required driving test, the District of Columbia police academy candidate was rejected in her bid to join the force.
Abstract: It had to be true. It was in the Washington Post. After 72 unsuccessful attempts to pass the required driving test, the District of Columbia police academy candidate was rejected in her bid to join the force. This clearly was the correct outcome. Yet I could not help but wonder, "What if she had passed on that 72nd try?" It seemed to me possible that the academy had somewhat of a lack of understanding of what it means to demonstrate basic competence.
TL;DR: The software user is concerned with the acquisition of microcomputer software that provides ease of access in a manner that allows the completion of tasks with as much efficiency as possible.
Abstract: The software user is concerned with the acquisition of microcomputer software that provides ease of access in a manner that allows the completion of tasks with as much efficiency as possible. The ease of access includes readily available backup copies of software in case of the destruction the original copy.